Cryptograss:Moods/security/todo - Revision history

DrivingThatTrain: Merged or closed, says githouse or GitHub: https://magenta.cryptograss.live/ramp/maybelle-config/magent/apache-2.4.71/

2026-11-13T00:44:15Z

Merged or closed, says githouse or GitHub: https://magenta.cryptograss.live/ramp/maybelle-config/magent/apache-2.4.71/

← Older revision		Revision as of 00:44, 13 November 2026
Line 40:		Line 40:
	link: "https://magenta.cryptograss.live/ramp/maybelle-config/magent/apache-2.4.71/"		link: "https://magenta.cryptograss.live/ramp/maybelle-config/magent/apache-2.4.71/"
	note: "Apache 2.4.69 → 2.4.71 in the wiki image, mod_http2 off, Protocols http/1.1. Not exploitable as deployed today (no mod_http2, 127.0.0.1 behind Caddy); this keeps it that way."		note: "Apache 2.4.69 → 2.4.71 in the wiki image, mod_http2 off, Protocols http/1.1. Not exploitable as deployed today (no mod_http2, 127.0.0.1 behind Caddy); this keeps it that way."
			done: true
	- task: "Redeploy pickipedia after the Apache merge"		- task: "Redeploy pickipedia after the Apache merge"
	who: justin		who: justin

Magent: #security: CVE-2026-119618 items (via update-page on MediaWiki MCP Server)

2026-11-12T15:55:59Z

#security: CVE-2026-119618 items (via update-page on MediaWiki MCP Server)

@@ Line 35: / Line 35: @@
    link: "https://members.nearlyfreespeech.net/"
    note: "ssh.nyc1.nearlyfreespeech.net offers publickey, password, keyboard-interactive. NFSN's public FAQ (checked 5 Nov) has no key-only switch, and the SSH password is the member password. So: make the member password long, random and used nowhere else; turn on 2FA for the member login; ask NFSN support for key-only SSH. maybelle's backups and builds reach it by key."
 </todo>

Magent: NFSN: no key-only option in their FAQ; what's left to do (via update-page on MediaWiki MCP Server)

2026-11-05T18:41:14Z

NFSN: no key-only option in their FAQ; what's left to do (via update-page on MediaWiki MCP Server)

← Older revision		Revision as of 18:41, 5 November 2026
Line 34:		Line 34:
	kind: infra		kind: infra
	link: "https://members.nearlyfreespeech.net/"		link: "https://members.nearlyfreespeech.net/"
	note: "ssh.nyc1.nearlyfreespeech.net offers publickey, password, keyboard-interactive. It's ~~their sshd~~, so the ~~change~~ is ~~an account setting~~, ~~not something in maybelle~~-~~config~~. maybelle's backups and builds reach it by key."		note: "ssh.nyc1.nearlyfreespeech.net offers publickey, password, keyboard-interactive. NFSN's public FAQ (checked 5 Nov) has no key-only switch, and the SSH password is the member password. So: make the member password long, random and used nowhere else; turn on 2FA for the member login; ask NFSN support for key-only SSH. maybelle's backups and builds reach it by key."
	</todo>		</todo>

Magent: #278 merged and deployed; re-probe confirms publickey only (via update-page on MediaWiki MCP Server)

2026-11-05T18:34:19Z

#278 merged and deployed; re-probe confirms publickey only (via update-page on MediaWiki MCP Server)

← Older revision		Revision as of 18:34, 5 November 2026
Line 27:		Line 27:
	kind: merge		kind: merge
	link: "https://github.com/cryptograss/maybelle-config/pull/278"		link: "https://github.com/cryptograss/maybelle-config/pull/278"
	note: "maybelle, pickipedia and delivery-kid ~~offer~~ password SSH ~~today~~ (magent's probe, block 26,349,412). ~~After the deploy,~~ re-probe: ~~each should~~ offer publickey only."		note: "maybelle, pickipedia and delivery-kid offered password SSH (magent's probe, block 26,349,412). Merged 5 Nov 18:18Z; magent's re-probe at block 26,350,449: all four offer publickey only."
			done: true
	done: true		done: true
	- task: "NearlyFreeSpeech: see whether the account can turn off password SSH, and turn it off if so"		- task: "NearlyFreeSpeech: see whether the account can turn off password SSH, and turn it off if so"

DrivingThatTrain: Merged, says GitHub: https://github.com/cryptograss/maybelle-config/pull/278

2026-11-05T18:18:24Z

Merged, says GitHub: https://github.com/cryptograss/maybelle-config/pull/278

← Older revision		Revision as of 18:18, 5 November 2026
Line 28:		Line 28:
	link: "https://github.com/cryptograss/maybelle-config/pull/278"		link: "https://github.com/cryptograss/maybelle-config/pull/278"
	note: "maybelle, pickipedia and delivery-kid offer password SSH today (magent's probe, block 26,349,412). After the deploy, re-probe: each should offer publickey only."		note: "maybelle, pickipedia and delivery-kid offer password SSH today (magent's probe, block 26,349,412). After the deploy, re-probe: each should offer publickey only."
			done: true
	- task: "NearlyFreeSpeech: see whether the account can turn off password SSH, and turn it off if so"		- task: "NearlyFreeSpeech: see whether the account can turn off password SSH, and turn it off if so"
	who: justin		who: justin

Magent: #security: SSH by key only (#278), NFSN password check (via update-page on MediaWiki MCP Server)

2026-11-05T15:08:26Z

#security: SSH by key only (#278), NFSN password check (via update-page on MediaWiki MCP Server)

@@ Line 23: / Line 23: @@
    kind: code
    note: "Moved from #ops. Columns: secret, destination, consumer, why, deploy-time or runtime. re's skeleton: #ops, 2 Nov 11:45Z. Each row carries the task's when: text. Completeness needs one read of the vault's key list by the password-holder."
 </todo>

DrivingThatTrain: Merged, says GitHub: https://github.com/cryptograss/maybelle-config/pull/267

2026-11-03T15:01:44Z

Merged, says GitHub: https://github.com/cryptograss/maybelle-config/pull/267

← Older revision		Revision as of 15:01, 3 November 2026
Line 5:		Line 5:
	link: "https://github.com/cryptograss/maybelle-config/pull/267"		link: "https://github.com/cryptograss/maybelle-config/pull/267"
	note: "Moved from #ops, 2 Nov 19:10Z. A GitHub issue when someone opens recovery, and the session streamed to an append-only log on maybelle. CI green. The token: fine-grained, Issues read+write on recovery_alert_repo only; everyone who should hear watches that repo. Without the vault entries it installs and stays quiet."		note: "Moved from #ops, 2 Nov 19:10Z. A GitHub issue when someone opens recovery, and the session streamed to an append-only log on maybelle. CI green. The token: fine-grained, Issues read+write on recovery_alert_repo only; everyone who should hear watches that repo. Without the vault entries it installs and stays quiet."
			done: true
	- task: "Root authorized_keys into deploy logic; identify or remove the unknown third key on hunter (justin, @maybelle, and one that matches nothing — file last changed by hand 2 Dec 2025; magent's 11:33Z check)"		- task: "Root authorized_keys into deploy logic; identify or remove the unknown third key on hunter (justin, @maybelle, and one that matches nothing — file last changed by hand 2 Dec 2025; magent's 11:33Z check)"
	who: justin		who: justin

Magent: Security todos moved here from Cryptograss:Moods/ops/todo (Justin, #security, 2 Nov 19:09Z) (via create-page on MediaWiki MCP Server)

2026-11-02T19:10:14Z

Security todos moved here from Cryptograss:Moods/ops/todo (Justin, #security, 2 Nov 19:09Z) (via create-page on MediaWiki MCP Server)

New page

<todo>
- task: "Put recovery_alert_github_token and recovery_log_private_key in the vault (public key in hunter's inventory), merge maybelle-config#267, redeploy maybelle then hunter"
who: justin
kind: merge
link: "https://github.com/cryptograss/maybelle-config/pull/267"
note: "Moved from #ops, 2 Nov 19:10Z. A GitHub issue when someone opens recovery, and the session streamed to an append-only log on maybelle. CI green. The token: fine-grained, Issues read+write on recovery_alert_repo only; everyone who should hear watches that repo. Without the vault entries it installs and stays quiet."
- task: "Root authorized_keys into deploy logic; identify or remove the unknown third key on hunter (justin, @maybelle, and one that matches nothing — file last changed by hand 2 Dec 2025; magent's 11:33Z check)"
who: justin
kind: infra
link: "https://pickipedia.xyz/wiki/Cryptograss:Security_Situation"
note: "Moved from #ops. The unknown key is yours to recognize. If you don't, remove it. Either way /root/.ssh should come from deploy logic like every other key — PR against maybelle-config."
- task: "Decide how people sign in from workbench, so it can drop magent's GitHub token and Magent's wiki password"
who: justin
kind: decision
note: "Moved from #ops. workbench runs as user magent; anyone there pushes as magent-cryptograss and edits as Magent. Tell skyler, rj and fibonacci before it lands."
- task: "Least privilege: what's left after #265–#267 (root paths and vault spills, magent's list from #emergence, 2 Nov 11:23Z)"
who: magent
kind: code
note: "Moved from #ops. Mine to PR: stop writing arthel's .env (Alchemy, Infura, Discord, Pinata) into homes without a mood:, and remove the copy in emergent-magent; add vault values to the scrubber's known list if any are missing; secrets as files under /run/secrets (small gain). Justin's to decide: emergents on non-Anthropic vendors (re, blu via OpenRouter/DeepSeek) send everything they read to that vendor, so their containers hold no secret they don't need; and whether full-tools wakes of magent (root via docker.sock) stay open to every key-signed-in person."
- task: "The secret map: generate secret and destination for every vault value from scripts/render_diff.py's walk, with a why per row; CI fails on a new row without one"
who: magent
kind: code
note: "Moved from #ops. Columns: secret, destination, consumer, why, deploy-time or runtime. re's skeleton: #ops, 2 Nov 11:45Z. Each row carries the task's when: text. Completeness needs one read of the vault's key list by the password-holder."
</todo>